Traffic abnormality detection system based on grey LOF (Live Object Framework), and detection method thereof

Abstract

The invention relates to the technical field of traffic abnormality detection, and particularly relates to a traffic abnormality detection system based on grey LOF, and a detection method thereof. The traffic abnormality detection system based on grey LOF collects an original data traffic package by an information collection module; the data is preprocessed by a data cleaning technology; a high-associated field of each traffic data package is extracted and concluded as a detection data source; by adoption of a grey level theory, the data provided by the information collection module is analyzed and prejudged through a grey distinction module, so as to greatly reduce the data computing scale, reduce the time complexity of an LOF algorithm, and improve the timeliness; the abnormality degree of the data traffic package is computed through an LOF analysis module; and, based on the density, a separation degree between each traffic package and a nearby traffic package is detected and computed. By adoption of the system and method, the specific abnormal state of the traffic is unnecessary to be preset; compared with the conventional method, the method is more flexible.

Description

technical field [0001] The present invention relates to the technical field of flow anomaly detection, and more specifically, to a gray LOF-based flow anomaly detection system and a detection method thereof. Background technique [0002] With the construction of the smart grid, the data network and the business systems it carries are developing rapidly, and a large amount of network traffic is generated every day. The abnormal traffic mixed with the normal traffic will cause great damage to the network, causing the quality of network service to drop sharply, and even cause the network to be paralyzed in severe cases. Therefore, detecting abnormal traffic is an important aspect of data network operation and maintenance. [0003] At present, abnormal traffic detection often uses principal component analysis to reduce the dimensionality of the network traffic matrix. This idea is simple and easy to understand and has high accuracy. The time complexity of the algorithm is O(n ...

AI Technical Summary

Problems solved by technology

[0003] At present, abnormal traffic detection often uses principal component analysis to reduce the dimensionality of the network traffic matrix. This idea is simple and easy to understand and has high accuracy. The time complexity of the algorithm is O(n 3 ), the time cost is too large; in addition, a network traffic timing analysis process model based on ODSP was proposed, and a multi-view collaborative visual analysis prototype system was designed, which can comprehensively detect network conditions, but most of the anomaly detection relies on manual completion; based on entropy theory The network traffic analysis method has also been proposed, using the long-term correlation characteristics of information units in the traffic space to improve the entropy theory, but it is difficult to solve the problem of large differences in traffic distribution in different time periods, and it is difficult to ensure a high detection rate and high detection rate at the same time. The misjudgment rate is low and lacks adaptability; some researchers also proposed methods based on signal analysis to detect anomalies by analyzing various characteristics such as signal spectrum and energy spectral density. However, due to the complexity and variety of abnormal traffic characteristics, Denaturation, this method has a high rate of missed detection and false detection

Images